MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c97ee9d7a7d3651ddd322f2bcd855175a6ea92d994e8aca722add0c6fe4eb977. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c97ee9d7a7d3651ddd322f2bcd855175a6ea92d994e8aca722add0c6fe4eb977
SHA3-384 hash:	dbc57d39230f2bef33b68ae58cbe372ff6df76390e48a52870c3c21c101e6dfc5d4eaf207b9d76ebf0ed926fdd656cde
SHA1 hash:	ca9baaa8ea081a621ee5bfe65d0a380df04bed81
MD5 hash:	57afe35e797de9ab6b2668c44cfb3df0
humanhash:	maryland-may-kentucky-uniform
File name:	download.vbs
Download:	download sample
Signature	EternidadeStealer Alert Create hunting rule
File size:	26'106 bytes
First seen:	2026-11-05 13:26:23 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:Ke7DiPv+YSpJrwd/3zGkxfx9v+vVj3VzYa3yV4nff7c6lSKCHuSFJD9GKBgGuZWs:Ke7DiPv+YSpJrwt3zGQfx9v+vVj3VzYQ
TLSH	T1B4C2413DCDAC023FE2B3D12DC49A0A16F993A95B723CDD4950C6738A5763482B49236F
Magika	vba
Reporter	johnk3r
Tags:	banker Downloader p79hbck1bsjf-cloudve-lat vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

133

Origin country :

BR

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/97411/

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aec843062f3df3e73e2adfd

Tags:

pace

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Using the Windows Management Instrumentation requests

Creating a process with a hidden window

Launching a process

Creating synchronization primitives

Sending a custom TCP request

DNS request

Connection attempt

Sending an HTTP GET request

Modifying a system file

Deleting a recently created file

Possible injection to a system process

Creating a file in the %temp% directory

Creating a process from a recently created file

Creating a file in the %temp% subdirectories

Creating a file in the Windows subdirectories

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm evasive fingerprint

Link:

https://www.filescan.io/uploads/6aec842b0cadbad184d6d59b/reports/a3485d9d-02a1-497e-901f-2e1ed0c17eed/overview

Hybrid Analysis GT:VB.Heur2.ObfDldr.34

Verdict:

Malicious

Labled as:

GT:VB.Heur2.ObfDldr.34

Link:

https://www.hybrid-analysis.com/sample/c97ee9d7a7d3651ddd322f2bcd855175a6ea92d994e8aca722add0c6fe4eb977

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

Link:

https://opentip.kaspersky.com/c97ee9d7a7d3651ddd322f2bcd855175a6ea92d994e8aca722add0c6fe4eb977/results?tab=lookup

Joe Sandbox

Gathering data

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

COM Behavior Trace DeObfuscated Obfuscated Scripting.FileSystemObject SOS: 0.70 T1027 T1047 T1059 T1059.005 VBScript WScript.Shell

Link:

https://app.malva.re/file/57afe35e797de9ab6b2668c44cfb3df0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c97ee9d7a7d3651ddd322f2bcd855175a6ea92d994e8aca722add0c6fe4eb977/

ReversingLabs TitaniumCloud Script-WScript.Packed.Generic

Threat name:

Script-WScript.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-11-05 13:27:11 UTC

File Type:

Text (VBS)

AV detection:

9 of 24 (37.50%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zf7otv5h2nsr3xjsf4v43bkrowtovewzstukzjzcvximn7soxf3q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/261105-qp5bzacy3m/

Behaviour

Checks processor information in registry

NTFS ADS

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes a VBScript file via the Windows Script Host.

Adds Run key to start application

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Badlisted process makes network request

Malware Config

Dropper Extraction:

https://0yc70i4vxz7m.cloudve.lat/stream_zip?file=G3d5duio.zip

VirusSign obfdldr

Malware Family:

obfdldr

Alert

Create hunting rule

Malicious:

True

Tags:

vba calls-wmi self-delete obfuscated macro-powershell checks-network-adapters long-sleeps

Link:

https://intel.virussign.com/intelligence/file/c97ee9d7a7d3651ddd322f2bcd855175a6ea92d994e8aca722add0c6fe4eb977

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c97ee9d7a7d3651ddd322f2bcd855175a6ea92d994e8aca722add0c6fe4eb977

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

EternidadeStealer

vbs c97ee9d7a7d3651ddd322f2bcd855175a6ea92d994e8aca722add0c6fe4eb977

(this sample)

EternidadeStealer

exe d63368fce09598cb938ba48d4add2432ab8a62607e2c7c688f6d1f81341dd38f

EternidadeStealer

msi b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc

  

Dropping

SHA256 b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc

Cape

https://www.capesandbox.com/analysis/97411/

  

Dropping

MD5 16d293a445306e01abe6691361df539b